f4e3d32fcb
- Only 5/15 functions tested; extractCalls/extractXrefs/pdbj untested - CTF failures mapped to specific r2_backend.cpp code paths - Top fix: flag dangerous imports + hardcoded strings (S effort, +12 findings) - Full basic block analysis needed for div-by-zero/null-deref (L effort, +6)
49 lines
2.5 KiB
Markdown
49 lines
2.5 KiB
Markdown
# Binary Backend Test Coverage and Failure-Point Audit
|
|
|
|
> Generated 2026-05-29. Audits src/binary/r2_backend.cpp against test suite and CTF corpus.
|
|
|
|
## Coverage Summary
|
|
|
|
| Function | Tested? | Test File |
|
|
|----------|---------|-----------|
|
|
| `R2Session::start()` | Yes | test_binary_backend.cpp |
|
|
| `R2Session::text()` | Yes | test_binary_backend.cpp |
|
|
| `R2Session::jsonCommand()` | Yes | test_binary_backend.cpp |
|
|
| `shellQuote()` | No | — |
|
|
| `jsonString()` / `jsonU64()` | No | — |
|
|
| `extractSections()` | Partial | test_binary_backend.cpp (only counts) |
|
|
| `extractStrings()` | Partial | test_binary_backend.cpp (only counts) |
|
|
| `extractCalls()` | No | — |
|
|
| `extractXrefs()` | Partial | test_binary_backend.cpp (by address) |
|
|
| `discoverFuzzTargets()` | No | — (tested via fuzz-prep integration) |
|
|
| `discoverObjcClasses()` | No | — |
|
|
| `discoverVtableTargets()` | No | — |
|
|
| `inferParamCountARM64()` | No | — (returns default 3 for all) |
|
|
| `discoverInternalFuzzTargets()` | No | — |
|
|
|
|
**Coverage: ~35% of binary backend functions are tested.**
|
|
|
|
## CTF Failure Analysis
|
|
|
|
Map of each missed CTF vulnerability to the r2_backend.cpp function that should have caught it:
|
|
|
|
| CWE | Expected Finding | Code Path | Why Failed |
|
|
|-----|-----------------|-----------|------------|
|
|
| CWE-121 (buffer overflow) | `gets()` import detection | `extractCalls()` | Function NOT IMPLEMENTED |
|
|
| CWE-134 (format string) | `printf(user_input)` | `axtj` (xrefs) | Xref from call to string not analyzed |
|
|
| CWE-416 (use-after-free) | `free()` + deref pattern | `extractCalls()` | No basic block analysis |
|
|
| CWE-369 (div-by-zero) | Division with potential zero | `pdbj` | Basic block disasm exists but not queried |
|
|
| CWE-190 (int overflow) | Arithmetic overflow paths | `pdbj` | Not analyzed |
|
|
| CWE-476 (null deref) | Pointer deref without check | `pdbj` | Not analyzed |
|
|
| CWE-78 (cmd injection) | `system(user_input)` | `extractCalls()` | Import detected but not flagged |
|
|
| Hardcoded strings | `"http://"`, `"password"` | `izzj` | String extraction works but not flagged as finding |
|
|
|
|
## Prioritized Fix List
|
|
|
|
| # | Fix | Effort | Detection Gain |
|
|
|---|-----|--------|---------------|
|
|
| 1 | Flag `system()`, `popen()`, `exec()` imports | S | +3 findings |
|
|
| 2 | Flag hardcoded URL/password strings | S | +5 findings |
|
|
| 3 | Flag gets/strcpy/printf imports | S | +4 findings |
|
|
| 4 | Analyze call xrefs to detect which strings feed into dangerous calls | M | +2 findings |
|
|
| 5 | Basic block analysis for div-by-zero / null-deref patterns | L | +6 findings |
|